Rust Engine¶

ThreatDeflect has a hybrid Rust engine compiled via Maturin/PyO3 that provides native performance for the heaviest analysis operations.

The engine is published as an independent crate on crates.io: threatdeflect-core

What the Rust engine accelerates¶

Using as a standalone Rust crate (independent from Python)¶

Add to your Cargo.toml:

[dependencies]
threatdeflect-core = "0.1"

use threatdeflect_core::SecretAnalyzer;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let rules = vec![
        ("AWS Key".to_string(), r"AKIA[0-9A-Z]{16}".to_string()),
        ("GitHub Token".to_string(), r"ghp_[a-zA-Z0-9]{36}".to_string()),
    ];

    let suspicious = vec![
        ("Reverse Shell".to_string(), r"bash\s+-i\s+>&\s+/dev/tcp".to_string()),
    ];

    let analyzer = SecretAnalyzer::new(rules, suspicious)?;
    let result = analyzer.analyze_content(
        "aws_key = AKIAIOSFODNN7EXAMPLE1",
        "src/config.py",
        "config.py",
    );

    for finding in &result.findings {
        println!(
            "[{:.0}%] {} in {} ({})",
            finding.confidence * 100.0,
            finding.finding_type,
            finding.file,
            finding.file_context.as_str(),
        );
    }

    Ok(())
}

Full crate documentation: docs.rs/threatdeflect-core

Automatic fallback¶

The Rust engine is optional in the Python context. If the threatdeflect_rs module is not compiled, ThreatDeflect automatically uses the pure Python implementation. All features remain available, only with lower performance on large analyses.

Compiling for Python¶

Requirements¶

• Rust toolchain (install via rustup.rs)
• Maturin (uv tool install maturin)
• Python 3.11+ in a virtual environment

Compilation¶

source .venv/bin/activate
maturin develop --release

The maturin develop --release command compiles the Rust module and installs it directly into the active virtual environment.

Verifying the installation¶

python -c "import threatdeflect_rs; print('Rust engine available')"

Architecture¶

threatdeflect-core/          Pure crate (published on crates.io)
  src/
    lib.rs                   Public re-exports
    analyzer.rs              SecretAnalyzer: orchestrates detection
    confidence.rs            Shannon entropy, scoring, adjustments
    context.rs               File classification, comments
    types.rs                 Finding, Ioc, AnalysisResult (with zeroize)
    error.rs                 AnalyzerError (thiserror)

rust_core/                   PyO3 wrapper (~50 lines)
  src/
    lib.rs                   Converts Rust types -> PyDict/PyList

The RustAnalyzer class is exposed to Python via PyO3 and provides the main method process_file_content() which receives a file's content and returns all findings (secrets, suspicious commands, IOCs, etc.).

Memory safety¶

Rust dependencies¶